Bug 676961 (CVE-2011-0720)

Summary: CVE-2011-0720 plone: unauthorized remote administrative access
Product: [Other] Security Response Reporter: Vincent Danen <vdanen>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: bressers, cluster-maint, edamato, jlieskov, kanderso, rmccabe, vkrizan
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2015-07-29 13:49:27 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On: 680514, 680515, 680516, 692659, 692660, 692661, 692662    
Bug Blocks:    

Description Vincent Danen 2011-02-12 03:34:34 UTC 
Common Vulnerabilities and Exposures assigned an identifier CVE-2011-0720 to
the following vulnerability:

Name: CVE-2011-0720
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-0720
Assigned: 20110131
Reference: http://plone.org/products/plone/security/advisories/cve-2011-0720
Reference: http://www.securityfocus.com/bid/46102
Reference: http://secunia.com/advisories/43146
Reference: http://xforce.iss.net/xforce/xfdb/65099

Unspecified vulnerability in Plone 2.5 through 4.0 allows remote
attackers to obtain administrative access, read or create arbitrary
content, and change the site skin via unknown vectors.

The hotfix for this issue is available here: http://plone.org/products/plone-hotfix/releases/CVE-2011-0720/

Some Plone components are included in conga, so this flaw may have some impact there.
Comment 9 errata-xmlrpc 2011-03-28 17:33:36 UTC 
This issue has been addressed in following products:

  Red Hat Enterprise Linux 5

Via RHSA-2011:0394 https://rhn.redhat.com/errata/RHSA-2011-0394.html
Comment 10 errata-xmlrpc 2011-03-28 17:33:52 UTC 
This issue has been addressed in following products:

  CLuster Suite for RHEL 4

Via RHSA-2011:0393 https://rhn.redhat.com/errata/RHSA-2011-0393.html
Comment 13 Josh Bressers 2011-03-31 19:25:13 UTC 
Created luci tracking bugs for this issue

Affects: fedora-all [bug 692661]
Comment 14 Josh Bressers 2011-03-31 19:25:17 UTC 
Created plone tracking bugs for this issue

Affects: epel-5 [bug 692662]